TLDR
North Korea-linked Lazarus Group has been tied to roughly 635 million dollars of DeFi hacks in April 2026, mostly hitting major protocols on Solana and Ethereum.
- Lazarus is blamed for a cluster of exploits totaling about 635 million dollars across DeFi protocols, with Drift Protocol and KelpDAO making up the bulk of losses.
- The group used advanced social engineering and bridge-level exploits, reflecting a shift from exchange hacks to deeply targeted DeFi infrastructure attacks.
- The hacks triggered a sharp DeFi TVL drop, bad debt on major lending platforms, and rising regulatory and governance intervention risk that DeFi users should watch closely.
Deep Dive
1. Scale Of The DeFi Thefts
Analysts report that North Koreas Lazarus Group was responsible for around 635 million dollars stolen from crypto protocols in April 2026, across roughly a dozen major incidents, according to one summary of the months hacks. The two largest hits were a roughly 285 million dollar exploit on Solanas Drift Protocol and about 292 to 293 million dollars drained from Ethereum restaking protocol KelpDAO via a LayerZero bridge, together accounting for almost all of the losses in some tallies. Other tracking, such as DefiLlamas data, puts April losses in the 606 to 625 million dollar range with 28 to 30 separate incidents, but still shows Drift and KelpDAO dominating the total.
This is not a single heist but a concentrated campaign in which a few extremely large DeFi exploits drove the headline 635 million dollar figure.
2. How Lazarus Carried Out The Attacks
Investigators link the Drift exploit to months-long, in-person social engineering, where North Korean proxies posed as legitimate partners before abusing privileged access, a step up in sophistication from typical remote phishing campaigns. For KelpDAO, Lazarus allegedly abused a previously flagged vulnerability in a cross-chain channel, spoofing bridge messages to withdraw hundreds of millions in rsETH, then pushing funds into lending protocols as collateral to borrow other assets. TRM Labs and others describe distinct laundering patterns, including converting proceeds to stablecoins, bridging to Ethereum, then either slow-laundering via ETH or moving quickly through privacy-oriented rails such as THORChain and Umbra.
The main risk is no longer just buggy contracts, but also human and governance lapses that sophisticated state-backed actors are learning to exploit.
3. Market Impact And What To Watch
The KelpDAO and Drift incidents helped trigger an estimated 13 to 14 billion dollars of value fleeing DeFi, especially bridges and lending platforms, with Aave alone seeing over 8.5 billion dollars in deposits exit and facing a large bad-debt hole. Ethereum DeFi sentiment weakened, with prediction markets pricing lower odds of ETH reaching aggressive upside targets in the short term after the hacks. On the response side, governance bodies like the Arbitrum Security Council froze attacker-linked funds and DAOs coordinated large recapitalization efforts, raising hundreds of millions in ETH and stablecoins to plug holes.
For DeFi users and investors, key things to monitor are bridge and restaking protocol security, the centralization of emergency controls, and any new regulatory pressure on laundering channels tied to North Korean activity.
Conclusion
Lazarus Groups April campaign shows how a small number of highly targeted DeFi exploits can steal hundreds of millions of dollars and rapidly erode trust across the ecosystem. The combination of advanced social engineering, bridge vulnerabilities, and heavy use of Ethereum-based liquidity makes DeFi, especially restaking and cross-chain infrastructure, a prime risk point. Going forward, the balance between fast innovation and robust security and governance will be crucial for whether similar attacks remain episodic shocks or become a persistent drag on DeFi adoption.
CoinsKid.Com